GlobalProtect 应用debug_drv.log显示"已找到潘格德设备 ROOT PANGPD \\0000，立即将其删除"，但无法连接 GlobalProtect 网关

6087

Created On 09/18/20 01:55 AM - Last Modified 12/02/24 20:44 PM

Symptom

GlobalProtect 应用无法连接到 GlobalProtect 网关。
错误"无法连接到 GlobalProtect 网关。请联系您的 IT 管理员。
重新启动 GlobalProtect 客户端解决问题。
debug_drv.log显示"已找到的潘格德设备 ROOT – PANGPD \0000，立即将其删除。" 并且未能连接， GlobalProtect 直到重新启动 GlobalProtect 下面的日志中显示的客户端。

看到问题时"debug_drv.log"：

[Debug  375]: Set debug level as 4
[Debug 1196]: Driver status is: 1.
[Debug  565]: Found pangpd device ROOT\PANGPD\0000, remove it now.
[Debug 1196]: Driver status is: 1.
[Debug  565]: Found pangpd device ROOT\PANGPD\0000, remove it now.
[Debug  944]: Disable adapter be called.
[Debug  375]: Set debug level as 4
[Debug 1196]: Driver status is: 1.
[Debug  565]: Found pangpd device ROOT\PANGPD\0000, remove it now.
[Debug 1196]: Driver status is: 1.
[Debug  565]: Found pangpd device ROOT\PANGPD\0000, remove it now.
[Debug  944]: Disable adapter be called.

"pan_gp_event.log"，当看到这个问题：

[Info ]: GlobalProtect service started (client version: 5.2.2-4, OS version: Microsoft Windows 10 Enterprise , 64-bit).
[Info ]: Portal login completed with address mobile.aisingroup.com and conect method of user-logon.
[Info ]: Network discovery started.
[Error]: Gateway Japan Central: Could not connect to the GlobalProtect gateway. Please contact your IT administrator.
[Info ]: Network discovery started.

Environment

GlobalProtect 应用程序（窗口）
第三方端点安全软件安装到 Windows 客户 PC 端。

Cause

第三方端点安全软件干扰 GlobalProtect 。

Resolution

根据以下文件夹配置第三方端点安全软件扫描的例外 GlobalProtect 情况。

C"\程序文件\帕洛阿尔托网络 GlobalProtect \"
C"\程序文件（x86）\帕洛阿尔托网络 GlobalProtect \"（如果使用32位 GlobalProtect 安装程序）
C"\用户<username>\[应用程序数据]本地\帕洛阿尔托网络 GlobalProtect \"</username>

Additional Information

客户在案例 01575213 中遇到以下第三方端点安全产品的问题。

产品名称：病毒布斯特公司版 XG （日语为 XG "ウイルスバスターコーポレートエディション"）
管理服务器版本：12.0.5474 服务包 1
客户端版本：12.0.5464 服务包 1，12.0.5474 服务包 1

当问题通过重新启动解决时，"debug_drv.log"：

[Info   304]: Init get adapter instance id {580B6BAC-2820-44DA-8D9D-2D75E74E8257}.
[Info   375]: Set debug level as 4
[Info   967]: Register returns MAC 02:50:41:00:00:01.
[Info   305]: Move binding order to the top
[Debug  384]: No need to adjust binding order
[Debug  431]: Found vif, index 11
[Debug  502]: Enable IPv4 weak host send mode for interface 15
[Debug  502]: Enable IPv4 weak host send mode for interface 28
[Debug  502]: Enable IPv4 weak host send mode for interface 6
[Info   204]: Register ends.
[Debug  944]: Disable adapter be called.
[Debug  957]: Enable adapter be called.
[Debug  838]: Enable Adapter success.
[Info   147]: Adapter device started. 0x0180200b
[Info   151]: ----Driver Control is being started
[Info   336]: Driver file version is 5.0.0.24.
[Info   498]: Access driver events.
[Info   509]: Device control set driver events.
[Info   532]: Device control set debug level as 3.
[Info   369]: Load driver control parameter 0x1.
[Info   579]: Device control set control parameter as 0x1.
[Info   555]: Device control set medium status as 1.
[Debug  771]: Device control get mac 02:50:41:00:00:01, size 6.
[Debug  923]: Device control get stat ends.
[Info   393]: Driver version: 0x600, MTU: 1400, Flags: 0x3, others: 1024-0-1.
[Info   177]: Service callback table gets set.
[Debug 1020]: New SendThread priority 2.
[Info   375]: Set debug level as 4

"pan_gp_event.log"，当问题通过重新启动解决时：

[Info ]: GlobalProtect service started (client version: 5.2.2-4, OS version: Microsoft Windows 10 Enterprise , 64-bit).
[Info ]: Portal login completed with address mobile.aisingroup.com and conect method of user-logon.
[Info ]: Network discovery started.
[Info ]: Auto Gateway login finished with address xxxxxxxxxxxxxxxxxxxxxxxxxxx.gw.gpcloudservice.com and user xxxxxxxxx (connect-before-logon).
[Info ]: IPSec tunnel creation finished with Gateway xxxxxxxxxxxxxxxxxxxxxxxxxxx.gw.gpcloudservice.com.
[Info ]: Completed HIP Report check with Gateway xxxxxxxxxxxxxxxxxxxxxxxxxxx.gw.gpcloudservice.com.